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DETAILED ACTION 

1 . Claims 1-10 have been examined. 

Claim Rejections - 35 USC § 102 

2. The following is a quotation of the appropriate paragraphs of 35 U.S. C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

3. Claim 1 is rejected under 35 U.S.C. 102(e) as being clearly anticipated by O'Brien et al. 
U.S. Pat. No. 6658571 (hereinafter O'Brien). 

4. As per claim 1, O'Brien discloses a security method for controlling use of an executable 
application, said method comprising the steps of: procuring a software executable policy 
enforcement agent which, when invoked, imposes one or more conditions on successful 
execution, and which, when successfully executed, invokes execution of said executable 
application (O'Brien: column 2 lines 12-39: software wrapper); encapsulating said executable 
application with said policy enforcement agent without changing said executable application, to 
thereby produce a combined program (O'Brien: column 3 lines 38-55); substituting said 
combined program for said executable application, so that said policy enforcement agent 
executes instead of said executable application program when said executable application is 
invoked (O'Brien: column 2 lines 12-39; column 5 line 56 - column 6 line 16); and one of (a) 
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satisfying said conditions of said control module, whereby said executable application executes, 
and (b) not satisfying said conditions, whereby said executable application does not execute 
(O'Brien: column 6 lines 5-16). 

5. As per claim 2, O'Brien discloses a method according claim 1 . O'Brien further discloses 
wherein said software executable policy enforcement agent includes a header component, and 
said substituting step includes the step of amending said header component of said policy 
enforcement agent portion of said combined program to match the characteristics of said 
combined program (O'Brien: column 2 lines 12-38: software wrapper is known to change the 
start-up code section of a software or program). 

Claim Rejections - 35 USC §103 

6. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

7. Claim 3 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien and 
further in view of Kayashima et al. U.S. Pub. No. 20010025346 (hereinafter Kayashima) and 
further in view of Eggebraaten et al. U.S. Pub. No. 20020120776 (hereinafter Eggebraaten). 

8. As per claim 3, O'Brien discloses a method according to claim 1 . O'Brien does not 
explicitly disclose wherein said executable application includes a VPN-tunneling-generating 
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application, and said step of satisfying said conditions includes the step of running an antivirus 
program. However, Kayashima discloses running antivirus and firewall and security policy 
procedures to perform security management (Kayashima: [0003]-[0014]). It would have been 
obvious to one having ordinary skill in the art at the time of applicant's invention to run antivirus 
program as security measure to determine whether the application is allowed to execute on the 
computer system. Therefore, it would have been obvious to one having ordinary skill in the art at 
the time of applicant's invention to combine the teachings of Kayashima within the system of 
O'Brien because using anti- virus program to perform security measures is well known in the art. 
O'Brien as modified does not explicitly disclose the executable application includes a VPN- 
tunneling-generating application. However, Eggebraaten discloses VPN software that protect 
data as it flows through VPN tunnel and use of VPN to protect data communicated through 
Internet (Eggebraaten: [0007] and [0031]). It would have been obvious to one having ordinary 
skill in the art at the time of applicant's invention to combine the teachings of Eggebraaten 
within the combination of O'Brien- Kayashima because it protects data while it's being 
communicated/transferred to avoid tampering. 

9. Claim 4 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Kayashima and further in view of Eggebraaten and further in view of Wolff et al. U.S. Pub. No. 
200201 74358 (hereinafter Wolff). 

10. As per claim 4, O'Brien discloses a method according to claim 1 . O'Brien does not 
explicitly disclose wherein said executable application includes a VPN-tunneling-generating 
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application, and said step of satisfying said conditions includes the step of running a antivirus 
program having an acceptable update status. However, Kayashima discloses running antivirus 
and firewall and security policy procedures to perform security management (Kayashima: 
[0003]-[0014]). It would have been obvious to one having ordinary skill in the art at the time of 
applicant's invention to run antivirus program as security measure to determine whether the 
application is allowed to execute on the computer system. Therefore, it would have been obvious 
to one having ordinary skill in the art at the time of applicant's invention to combine the 
teachings of Kayashima within the system of O'Brien because using anti-virus program to 
perform security measures is well known in the art. O'Brien as modified does not explicitly 
disclose the executable application includes a VPN-tunneling-generating application. However, 
Eggebraaten discloses VPN software that protect data as it flows through VPN tunnel and use of 
VPN to protect data communicated through Internet (Eggebraaten: [0007] and [0031]). It would 
have been obvious to one having ordinary skill in the art at the time of applicant's invention to 
combine the teachings of Eggebraaten within the combination of O'Brien-Kayashima because it 
protects data while it's being communicated/transferred to avoid tampering. O'Brien as modified 
does not explicitly disclose running an antivirus having an acceptable update status. However, 
Wolff discloses virus event report that shows update status and it allows virus definition data 
updates to be downloaded by user or as part of a regular scheduled update process (Wolff: [0010] 
and [0033]). It would have been obvious to one having ordinary skill in the art to using antivirus 
program that has acceptable update status to determine the security of data. Therefore, it would 
have been obvious to one having ordinary skill in the art at the time of applicant's invention to 
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combine the teachings of Wolff within the combination of O'Brien-Kayashima-Eggebraaten 
because only using up-to-date antivirus program allows precise security measure. 

11. Claim 5 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Kayashima. 

12. As per claim 5, O'Brien discloses a method according to claim 1 . O'Brien does not 
explicitly disclose wherein said step of satisfying aid conditions includes the step of running a 
personal firewall program. However, Kayashima discloses running antivirus and firewall and 
security policy procedures to perform security management (Kayashima: [0003]-[0014]). It 
would have been obvious to one having ordinary skill in the art at the time of applicant's 
invention to run antivirus program as security measure to determine whether the application is 
allowed to execute on the computer system. Therefore, it would have been obvious to one having 
ordinary skill in the art at the time of applicant's invention to combine the teachings of 
Kayashima within the system of O'Brien because using anti-virus program to perform security 
measures is well known in the art. 

13. Claim 6 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Shear et al. U.S. Pat. No. 6292569 (hereinafter Shear). 



14. As per claim 6, O'Brien as modified discloses a method according to claim 1. O'Brien as 
modified does not explicitly disclose wherein said executable application accepts verification 
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information in a format other than a digital certificate, and said step of satisfying said conditions 
includes the step of accepting a digital certificate. However, Shear discloses using certificates 
and digital signatures to protect computer systems from bogus load modules, executables and 
applications (Shear: abstract and column 5 lines 4-50). It would have been obvious to one having 
ordinary skill in the art to check the digital certificate of a program before the wrapper program 
actually invokes the program. It would have been obvious to one having ordinary skill in the art 
at the time of applicant's invention to combine the teachings of Shear within the system of 
O'Brien because digital certificates provide certain trust level to a data so that it can be used to 
determine whether the data is secure or from s secure source. 

15. Claim 7 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Shear and further in view of Atkinson et al. U.S. Pat. No. 6367012 (hereinafter Atkinson). 

16. As per claim 7, O'Brien as modified discloses a method according to claim 6. O'Brien as 
modified does not explicitly disclose wherein said step of accepting a digital certificate includes 
the step of accepting an X.509 based digital certificate. However, Atkinson discloses embedding 
standard X.509 digital certificate within executable file in order to check whether the executable 
file comes from a trusted source (Atkinson: column 2 line 35 - column 3 line 62 and column 7 
lines 10-19). It would have been obvious to one having ordinary skill in the art at the time of 
applicant's invention to combine the teachings of Atkinson within the combination of O'Brien- 
Shear because X.509 digital certificate is a standard format. 
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17. Claim 8 is rejected under 35 U.S.C. 103(a) as being unpatentable over O'Brien in view of 
Shear and further in view of Cooper et al. U.S. Pub. No. 20020029350 (hereinafter Cooper). 

1 8. As per claim 8, O'Brien as modified discloses a method according to claim 6. O'Brien as 
modified does not explicitly discloses the method comprising the step of translating at least some 
information from said digital certificate into a form recognizable by said executable application. 
However, Cooper discloses most of the major browser programs can recognize digital 
certificates and know where and how to store them (Cooper: [0261]). It would have been obvious 
to one having ordinary skill in the art to use the wrapper program that wraps browser programs 
to recognize the digital certificate and use the digital certificates to determine whether 
software/programs are allowed to execute. Therefore, it would have been obvious to one having 
ordinary skill in the art at the time of applicant's invention to combine the teachings of Cooper 
within the combination of O'Brien-Shear because translating digital certificate so that it can be 
recognized by different programs is well known in the art. 

19. As per claim 9 and 10, claims 9 and 10 disclose the same scope as that of claims 1 and 2. 
Therefore, claims 9 and 10 are rejected based on the reasons stated in rejecting claim 1. 
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Conclusion 

20. The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Tajalli et al. U.S. Pat. No. 5361359 discloses limit execution of application programs to 
the approved applications. 

Lambert et al. U.S. Pub. No. 20020099952 discloses policies for secure software 
execution. 

Epstein et al. U.S. Pat. No. 6684329 discloses system and method for increasing the 
resiliency of firewall systems by using software wrappers. 

Epstein et al. U.S. Pat. No. 6584508 discloses advanced data guard having independently 
wrapped components. 

Fraser et al. 'Hardening COTS Software with Generic Software Wrappers'. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shin-Hon Chen whose telephone number is (703) 305-8654. The 
examiner can normally be reached on Monday through Friday 8:30am to 5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (703) 305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 

Shin-Hon Chen 
Examiner 
Art Unit 2131 

SC 
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